----------------------------------------------------------------------

Want a new job?

http://secunia.com/secunia_security_specialist/
http://secunia.com/hardcore_disassembler_and_reverse_engineer/

----------------------------------------------------------------------

TITLE:
VMware Products Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA30556

VERIFY ADVISORY:
http://secunia.com/advisories/30556/

CRITICAL:
Less critical

IMPACT:
Security Bypass, Privilege escalation

WHERE:
Local system

OPERATING SYSTEM:
VMware ESX Server 3.x
http://secunia.com/product/10757/
VMware ESX Server 2.x
http://secunia.com/product/2125/

SOFTWARE:
VMware Workstation 5.x
http://secunia.com/product/5080/
VMware Server 1.x
http://secunia.com/product/10733/
VMware Player 1.x
http://secunia.com/product/6594/
VMware ACE 1.x
http://secunia.com/product/6593/
VMware VIX API 1.x
http://secunia.com/product/18985/

DESCRIPTION:
Some vulnerabilities have been reported in multiple VMware Products,
which can be exploited by malicious, local users to bypass certain
security restrictions or to gain escalated privileges.

1) An error exists in the "HGFS.sys" driver included in the VMware
Tools package. This can be exploited to execute arbitrary code with
escalated privileges on a Windows guest machine.

2) An error in "vmware-authd" can be exploited to gain escalated
privileges on a Linux host machine.

For more information see vulnerability #3 in:
SA30476

3) An error within the processing of "Content-Length" headers in the
Openwsman management service can be exploited to gain "root"
privileges.

4) Multiple boundary errors in the VMware VIX API can be exploited to
cause buffer overflows.

For more information see vulnerability #4 in:
SA30476

Please see vendor's advisory for a list of affected products and
versions.

SOLUTION:
Update to the latest version or apply patches.

VMware Workstation 5.x:
Update to version 5.5.7.
http://www.vmware.com/download/ws/ws5.html

VMware Player 1.x:
Update to version 1.0.7.
http://www.vmware.com/download/player/

VMware ACE 1.x:
Update to version 1.0.6.
http://www.vmware.com/download/ace/

VMware Server 1.x:
Update to version 1.0.6.
http://www.vmware.com/download/server/

VMware VIX 1.x:
Update to version 1.1.4.
http://www.vmware.com/support/developer/vix-api/

VMware ESXi 3.5:
Apply patch ESXe350-200805501-O-SG.
http://download3.vmware.com/software/esx/ESXe350-200805501-O-SG.zip

VMware ESX 3.5:
Apply patches.
http://download3.vmware.com/software/esx/ESX350-200805515-SG.zip
http://download3.vmware.com/software/esx/ESX350-200805508-SG.zip
http://download3.vmware.com/software/esx/ESX350-200805501-BG.zip

VMware ESX 3.0.2:
Apply patches.
http://download3.vmware.com/software/vi/ESX-1004727.tgz
http://download3.vmware.com/software/vi/ESX-1004821.tgz
http://download3.vmware.com/software/vi/ESX-1004216.tgz
http://download3.vmware.com/software/vi/ESX-1004726.tgz

VMware ESX 3.0.1:
Apply patches.
http://download3.vmware.com/software/vi/ESX-1004186.tgz
http://download3.vmware.com/software/vi/ESX-1004728.tgz
http://download3.vmware.com/software/vi/ESX-1004725.tgz

VMware ESX 2.5.5:
Apply upgrade patch 8.
http://download3.vmware.com/software/esx/esx-2.5.5-90521-upgrade.tar.gz

VMware ESX 2.5.4:
Apply upgrade patch 19.
http://download3.vmware.com/software/esx/esx-2.5.4-90520-upgrade.tar.gz

PROVIDED AND/OR DISCOVERED BY:
1) The vendor credits Stephen Fewer of Harmony, reported via
iDefense.
2) The vendor credits iDefense.
3) Alexander Sotirov, VMware Security Research
4) Reported by the vendor.

ORIGINAL ADVISORY:
http://www.vmware.com/security/advisories/VMSA-2008-0009.html

OTHER REFERENCES:
SA30476:
http://secunia.com/advisories/30476/

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------